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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

FORT GEORGE G. MEADE MARYLAND 207S5-«000 


6 August 2012 


MEMORANDUM FOR THE CHAIRMAN. INTELLIGENCE OVERSIGHT BOARD 

THRU: Assistant to the Secretarj’ of Defense (Intelligence Oversight) 

SUBJECT: (U/ /l'OUO) Report to the Intelligence Oversight Board on NSA Activities - 
INFORMATION MEMORANDUM 

(U/ / l' OUO) Except as previously reported to you or the President, or otherwise stated in the 
enclosure, we have no reason to believe that intelligence activities of the National Security Agency 
during the quarter ending 31 March 2012 were unlawful or contrary to Executive Order or Presidential 
Directive and thus should have been reported pursuant to Section 1.6(c) of Executive Order 12333. as 
amended. 

(U//FOUO) The Inspector General and the General Counsel continue to e.xercise oversight of 
Agency activities by inspections, surveys, training, review of directives and guidelines, and advice and 
counsel. These activities and other data requested by the Board or members of the staff of the Assistant 
to the Secretary of Defense (Intelligence Oversight) are described in the enclosure. 




GEORGE BLLARD 
Inspector General 

RAJESH de 
G eneral Counsel 


(U/ /l'OUO) I concur in the report of the Inspector General and the General Counsel and hereby 
make it our combined report. 


KEItH BTTM-EXAyDER 
General. U. S. Army 
Director. NSA/Chief. CSS 


Enel: 

Quarterly Report 


uiflfUilSMilsiii 


This document may be declassified and marked 
••UNCLASSlFIED/z Ti 'i OfHi i al Usu ' ^ ii K" 
upon removal of enclosure(s) 


elease bv NSA on 12-19-2014. FOIA Case # 70809 
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I. (U) Intelligence, Counterintelligence, and Intelligence-Related Activities that 
Violated Law, Regulation, or Policy and Were Substantiated during the 
Quarter, as well as Actions Taken as a Result of the Violations 

LA. (U) Intelligence Activities Conducted under Executive Order (E.O.) 12333 
Authority 

I.A.1 (U) Unintentional Targeting or Database Queries against U.S. ^ 36-36 

(USPs) or Foreign Persons In the United States (b)(3)-so use 3024 (i) 


(g'''SI""R CL TO I'fiA. rVCY.) During the first quarter of calend ar year 2012 (CY2012). 
NSA continued 1 As part of that process. 

duplicate selectors were i eino\ ed and the number of active selectors ] 

was reduced. As a result. |N SA's primary tasking tools for telephone a nd Internet 

selectors contained approximately! lactive selectors, down from the_ reported 


was reduced. As a result. } jN SA's primary tasking tools for telephone a nd Internd 

selectors contained approximately ] l active selectors, down from the | reported 

last quarter. 

(b)(3)-P.L. 86-36 

(U/ /POU &1 Also during the first quarter of CY201 2. signals intelligence (SIGINT) 
analysts in | | instances inadvertently targeted communications to. from, or about USPs while 
pursuing foreign intelligence tasking. Unless otherwise specified, all intercepts, query results, 
and reports have been deleted or destroyed as required by United Stales SIGINT Directive 

. A . .V -P . • 66-36 

I.A.1.a. (U) Tasking Errors (b)(3)-50 use 3024(i) 


targeted his personal cell phone | 

error occurred because the analyst mistakenly thought that it woul 
on his own phone. All non-compliant data was deleted 


Ian NSA analyst 
I The 

3e acceptable to| 


f9ff81//REL 7*0 USA. FVE¥l | [ analyst discovered 

that a selector believed to be a valid foreign intelligence target w as associated with a USP with 
dual citizenship The selector was detasked f ] All non-compliant data was 

purged. (b)( 1 ) 


(b)(3)-P.L. 86-36 


I All data has been purged. 

(9//9I//REL TO U3A. FVEY) !^ | an NSA analyst discovered that a 

tasked selector believ ed to be a valid foreign intelligence targ et was associated with a USP. The 
selector was detasked [ was asked to purge the data. No 

reports were issued. 


(b) (1) 

(b){3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


Derived From: NSA C.^SM 1-52 
Dated: 2007()l()H 
Declassify On: 20570710 
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'.(b) (i) 

(b"V.,C3.),;-P'."E'.-.a.&-36 


(b)(1) 

(b)(3)-P.L. 86-36 
(b) (3)-50 use 3024 (i) 


through research | 
selector wa s detaskedi 
was purged_ 


that a selector tarsietedl 


_[analyst discovered 

I beToimed to a USP. The 
l and results were deleted, and data 
jiepons were cancelled! | 


_ (TS/i''Sh'/N£4 it wa s discovered thatQ selectors associated with 

I [had been erroneously tasked The selectors wer e 

supposed to have been I I 

were mistakenlv entered into the tasking database. Selectors were ta^edl '-^1 


AH non-compliant data was purged 


(-P.L. 86-36 


(G ' /S I 'RIIL TO USA. r\'[]!*r )|_I it was discovered that a selector 

associated with a USP had been tasked because of a typographical error. The selector was 
detasked that same day. and no collection occurred. Ij,) 

,_, (b)(3)-P.L. 86-36 

(S//Sh ‘ /RCL TO U3A. PVC' » ' ) | it was discovered thattfliKBiSAO use 3024(i) 

analyst had tasked a selector associated with a USP. The error occurred because the selector had 

I The selector was de^^p^ l | 

I I No collection occurred, and no reports were issued. (b)(3)-p.L. 86-36 

(b)(1) _ (b) (3)-50 use 3024(i) 

(b) (3)-p.L. 86-3 tS//Cl)'/RCL TO UGA. rVCYl l I an NSA analyst discovered that a 

selector associated with a USP had been erroneously tasked | 

T he error occurred because sufficient researc h had not been completed. Tlie selector was 
cietasked i I purge all data, and no reports were issued. 

(GiVOI/ZRCLTO USA. FVEVl f I an NSA analyst discovered that a 

selector for a valid foreig n intelligence target had mistakenly been left on task while the t arget 
was in the United States ( <4 1 

I No collection occurred, and no reports 


Ian NSA analyst discovered that a sel ector associated 
with | I As a result of a 

typograp hical error byj | a misspelled sele ctor had been entered into NSA’s 

database | | When the NSA analyst ran a query on the 

correctly spelled selecto j I 

therefore, the analyst began to review the query results, which highlighted the problem. The 

database entry has since been corrected. The analyst detasked the selector_ 

All queries and query results were deleted. One report had been published; it was cancelled and 
re-issued without the USP reference. 


(S^^SP^RCL TO USA. TVCY) While scanning traffic L an NSA analyst 

discovered that a selector associated with a US P had been erroneously tasked. The error 
occurred because the USP | | as the valid foreign intelligence target and the 

targeting analyst had not thoroughly researched the selector. The selector was detasked f | 

I I The query and query results were deleted, and no reports were issued. 


(b) (1) 

(b){3)-P.L. 86-36 
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.86-36 

(b) (1) 

(b) (3)-P.L. 86-36 

TOP SECRET//SI//NOFORN (b) (3)-50 use 3024( 


an NSA analyst discovered that a selector associated with 

a USP had been erroneously taskedi Althoush the analyst conducted the 

required research. 

Kvho passed the selector to NSA. failed to provide the USP 

status. The selector was aeiasKea.j {were deleted The 


analyst was counseled about the importance of questioning lead information. 


LA l.b. (U) Database Queries 


(b)(3)-P.L. 86-36 
(b) (3)-so use 3024(i) 


TS /ZS I Z/RTL TO L'fj.A r\T -¥tr 


■ 86-36^U^i rOLfO) O n i l occasioiis during this quarter, analysts performed overly broad or 
poorly constructed database queries that potentially targeted and/or returned information about 
USPs. These queries usedP 


results. 


Jthat produced imprecise 

(b)(1) 

(b) {3)-P.L. 


(6//[\EL TO U S A. FVEY) On l l ofthose occasions, the queries returned results from 
the database. The query results were deleted or aged off. as required, and no reports were issued. 
Analysts who performed these queries were counseled by their management. 


86-36 


(U) Procedural and other errors contributed to the following incidents. 


D (S//SI//R E L TO USA. FV E Yl l I NSA analysts 

performed ] I queries in raw traffic databases without first performing the required research 
on the selectors. All the queries returned results, which were deleted; no reports were issued. 

86-36 ,-, 

D (StfCl//RCL TO UGA. rveT ) | j in response 

to a customer's request for information. NSA analysts performed ] I queries in raw traffic 
databases using selectors believed to be associated with foreign intelligence targets. The 
analysts disseminated the results via e-mail. The analysts later learned that the targets were 
USPs. All query results were deleted, and the customer was notified to delete all e-mails. 
The analyst was counseled on proper procedure for evaluating selectors before querying. 


(£//SI/)TlEL TO UGA. rvcvj 


_Ian NSA analyst inadvertently performed a 

query in a raw traffic database on a selector associated with a USP. The analyst had intended 
to search on a valid foreign intelligence selector but acciden tally searched on the selector for 
the USP The results were deleted, and no 

reports were issued. The analyst was counseled to be more careful when performing queries 
in raw traffic databases. 


(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-18 use 798 
(b) (3)-50 use 3024(i) 


TOP SECRET//Sl/morORN 
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TOP SECRET//S I // N OFORN 


■'(b) (1) 

<b) (3)-P.L. 86-36 
(b) (3)-50 use 3024(i) 


(S//SI//RCL TO USA. rVCY) [ 


it was discovered that an NSA analyst had 


performed a query in a raw traffic database using an e-mail selector associat ed with a USP. 
The analyst mistakenly believed that the e-mail selector was associated with 
The query results were deleted. 


(TS//SI//REL TO U SA. FV ^f 
raw tra ffic database I 


analyst 


~| an NSA analyst performed a query in a 
I The error occurred be cause the 


No 


results were returned from the quer y, and no reports were issued. The analyst was counseled 
on the importance of | [ before performing queries. 


(&toi/,tl[:l to U3A. rvi!V} [ 


an NSA database auditor discovered that 


an analyst had conducted a query in a raw traffic database on a selector associated with a 
foreign target living in the United States. The error occurred because the analyst did not 
perform the required research on the selector. The results were deleted, and the analyst was 
counseled. tb) (i) 

86-36 (b)(3)-P.L. 86-36 

(S//S1//RELT0USA.FV 1 ]Y) | | an NSA analyst performed 3024 (i) 

raw traffic database on selectors thought to be associated with a valid foreisin intelliuence 


target.] 


| the queried target was determined to be in the United States. All 
data was purged. The analyst was counseled on the process for conducting searches. 


(G//ai//RCL TO USA. rvcv'J 


it was discovered that! 


Iquery that included the selector for a valid foreign intelligence target] 


"V while the target was in the United States. Although the analyst 

the analyst forgot to remove the selector 


In addition, query results from 
The selector was removed 


were 


e-mailed to another team member 

I and the team member verified deletion of the query results^ 


(g//Dl//REL TO UGA. rVCY) [ 


an NSA analyst queried a raw tra^'fic 
database using his personal cell phone number while in deployment training. The analyst 
and class were counseled. Additional information on the proper use of the database was 
added to the training. No results were returned by the query. 


-P.L. 86-36 


(9//91//REL TO USA. r\TV) [ 


^analyst performed a 


query in a raw traffic database that inadvertently included a USP telephone number. The 
query returned no results. 


(S/ZSIZ/ RCL TO UGA. 
queries] 


oiiiiinallv tasked] 


an NSA analyst inadvertently performed 

Ion a selector associated w ith a USP. The selector. _ 

was detaskedi 


status 


1 However, the analyst was new to the office and was unaware of (he USF 


1 ) 

3)-P.L. 86-36 
3)-50 use 3024(i) 


TOP SECRET// 9 I//NOFORN 
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(b! (1) '' 

(b)(3)-P.L.„86-36 

u -m 


reports were issued. The analyst was counseled about the importance of using current 

information to verify location. .(b) (l) 

(b) (3)-P.L. 86-36 

D (S//SI//REL TQUGA. rVTY) | I an analyst inadvertently ran a query in a 

raw traffic database on selectors associated with a target and included the period the target 
was in the United States. The selectors associated with the target had been detasked T I 

I j he United States. The query and results were deleted, and no reports were 

issued T he analyst was reminded about the importance of checking branch records on 
before running such queries. 

D (S//SI//RCL TO U9 A. FVE^l H [an NSA analyst performed a quer y in a 

raw traffic database F I T he 

error occurred because the analyst did not know that the| | 

I (b)(3)-P.L) 86-36 

I-1 (b)(3)-50 use 3024(i) 

D (S//SI//RCL TO USA. rVTY) l A nalyst queried a 

selector associated with a valid foreign intelligence target for the period during which the 
target was traveling in the United States. This analyst had not reviewed an e-mail from 
another NSA analyst | The query results were deleted. and no 

reports were issued. 


(S.VS I //REL TO USA.- f V e V") |_| analysts performed 

I k iueries in raw traffic databases without first performing the required research on the 
selectors. \ [ queries returned results, which were deleted; no reports were issued. 

tTFi//Fil//Nr) l I an NSA analyst mistakenly performed a query on an 

[ Foreign Intelligence Surveillance Act 

(FISA)-authori 2 ed selector as sociat ed with a valid foreign intelligence target in a raw traffic 
database not authorized under [ [ FISA. No collection or reporting occurred. The analyst 

was counseled on evaluating selectors before querying. . (b) (i) 

_" (b)(3)-P.L. 86-36 

(S//S1//REL TO USA. FVCY) ! [ an analyst di scovered thatj | 

I I that had been detasked [ *] 

because ofthe target'! [ the United State s. The analyst responsible for the 

“ I The query results were deleted on 

I when the analyst responsible for the tasking returned from leave. No reporting 

occurred The analyst was counseled r egarding the need_ 

[ the United States. 

(G//SI//REL TO USA. _it was discovered that an analyst, in 

response to a customer request for information (RFl). performed I [qu eries on a USP in a 
database F [ This error occurred 

because the analyst had not carefully read the RFl. The query results were deleted. The 
analyst was counseled to review RFls thoroughly before performing database queries, and 
the customer was alerted that NSA would not support these types of RFls. 


(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(b) (1) 

(b)(3)-P.L. 86-36 



croi 


DOOI®): 

(>-') (3) 
(b) (3) 


na) 

1 (3)-P.L. 


4165217 


-50 use 3024 (i) 


TOP SECRET//SI//NOFORN 


(b)(1) 

(b)(3)-P.L. 


86-36 


] (S/ZaiyREL TO USA. PVEV) 


anNSA analyst performed ! bueries 
in a raw traffic database on a selector for a valid foreiaii iiitellisience taruet butl 


A copy and paste error 


P 


] No results were returned from any of 


ilie queries, and no reports were issued. The analyst was counseled on correct procedures for 


86-36 


f3//3I//RCL TO USA. r\TY) [ 


an NSA analyst mistakenly 


[ 


performed f~~loverly broad queries in two raw traffic databases. The queries were performed 


J The analyst deleted the queriesj_ 


the queries had reappeared- It is not known whether the 


queries reappeared as a result of analyst or system error. The analyst deleted the queries 

'[ 


auain 


funder the supervision ofthe Intelligence Oversight (10) Officer (100). 


No results were returned by the queries and no reports were issued. The analyst was 
counseled regarding correct query procedures. 


] (3//3 I //RCL TO UGA. rVCV)[ 


^analyst ran a query on 


an e-mail selector associated with a USP who held d ual citizenship. The target’s citizenship 

was discovered later through | | The query results were deleted. The 

selector was not tasked, and no reports were issued ' (b) (i) 

_ (b){3)-P.L. 86-36 

(S//SI//REL TO USA. rVCY) | I an analyst performed a query in a raw 

traffic database on a selector associated with a valid foreign intelligence target and included 
the period the target was in the United States. The error occurred because the time period 
checked did not coincide with the dates ofthe query. The query results were deleted, and no 
reports were issued. 


] (0//SI//RE ' L-TOU3A. rVTV) [ 


an analyst performed a qiieiy in a raw 
traffic database on a selector associated with a valid foreign int elligence target and included 
the period the taruet was in the United States. The analyst was| 


res iewing the query results before reaching the U S travel dates 
and no reports were issued. The analyst was reminded about the importance 
[befoi e running such queries. 


The analyst stopped 
TTTe results were deleted. 


(S ’SI' P.EL TO UO.V nTV l l 
query in a raw traffic database l 
thorough research and was unaware I 
regarding the importance of identifying 


tDJ U)- 

(b) (3)-P.L. 86-36 
(b) (3)-50 use 3024(i) 
an NS A analyst mistakenly performed a 

The analyst had not conducted 
The analyst was counseled 


] (S//S1//RCL TO USA. rV[ ' Y) [ 


before submitting queries(b) (i) 

(b) (3)-P.L. 86-36 
an NSA analyst queried telephony 


selectors believed to be associated with va lid foreign intelligence targets. The query results 
identified the users ofthe selectors asU.S.I 


All data has been purged. 


TOP 3 ECRCT//OI//NOrQnN 


(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 
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(fa.) ( 3 )-p L g 6_36 TOP SCCRi:T//ai//NOFORN 

(b)\,(3)-18 use 798 
(fa) (3)-50 use 3024( i) 

D tn uOiV r^T ^ f Tl I an NSA analyst perfor med a query in a raw 

traffic data ba^ i" I The analyst did not know that ] ^~| 

had been assigned to a USP No results were returned by the query, and no reports were 
issued The analyst was counseled about performing checks before submitting queries. 

D (S//5I//RCL TO UGA. rVCV) _analyst s performed I I 

queries in raw traffic databases on valid foreign intelligence selectors while the targets were 

in the United States The analysts did not perform the required research on the selector or did 

not I In two instances, the queries returned results, which were 

deleted. No reports were issued. The analysts were counseled on the importance ofjj^j m 

reviewing all available information before executing queries (b) (3 )-p.l. 86-36 

D (S//9I//REL TO USA. FVEV} | I an analyst performed | Q ueries 

in a ra w traffic database without first conducting the required research on the sele ctor. The 
queries [~ | No results 

were returned from any of the queries, and no reports were issued. The analyst was reminded 

about the importance of checkinu the selector location. (fa) {i) 

'_ (b)(3)-P.L. 86-36 

D (9//S1//REL TO USA. FVEY?! an NSA analyst performed a query on a 

I T ^The query and results were immediately 

deleted. The analyst was counseled on proper query procedure. 

D (0//0!/jTICL TO UO A. rVCVH I an NSA analyst performed a query in a 

raw trafTic database f | asthe search term. The analyst had expected 

the query to return foreign intelligence information. The query' re sults were d^q4.-) ’’o 

reports were issued. The analyst was counseled not to use^ is search teriits) (3) -p.l. 86-36 

_ ■-1 (fa)'(3)-50 use 3024(i) 

D (S//S1//RCL TO UGA. rVCV) i a database auditor discov ered that an 

analyst had mistakenly performed a query in a raw traffic database on a U.Sd^^^^l The 
an alyst had intend ed to use the foreign taruet's l I but confused lhat | | with 

thd I No results were returned by the query, and no reports were issued 


( S // S I//P 1 EL TO USA FVCYI i _ I an NSA analyst performed ! I queries i n 

a raw traffic database } j The analyst was not aware that the j 

I 1*^0 results were returned by the queries and no reports 

were issued. The analyst was counseled regarding the incident. 


(S//SI//REL TO USA. FVEY) | I during a routine database audit, an NSA 

databas e auditor discovere d that an analyst had perform^ a query using a U S. e-mail 
selector ! j T he error occurred b ecause the analyst had copied and pasted the 

e-mail selector into the query_ The query results were deleted, and no 

reports were issued. The analyst was counseled on the importance of reviewing queries 
before submitting them, 

(S//SI//REL TO USA. FVGYl l j an NSA analyst performed a query on 

selectors believed to be associated with a foreian intelligence tarset. The analyst learned □ 
from a database auditor that the target held dual U.S. and | | citizenship. 


(b) (1) 

(b)(3)-P.L. 86-36 
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TOP 9CCRET//S I //NOrORN 


tb) (1) 

(b) (3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


The query results were deleted, and the selectors were detasked 


The analyst 


was counseled on the importance of using branch working aids to research potential 
selectors. 


D (S//SI//RCL TO USA. FVCY) 


an NSA analyst inadvertently performed a 


queiy in a raw t raffic database| 

based on a previous compliant query, and the analyst believed that the 


ivould not create a non-compliant query. No results were ret urned by the query, and 


no reports were issued. The analyst vvas counseled to exercise caution 


(b)(1) 

(b)(3)-P.L. 86-36 

an NSA analyst performed a query in a raw traffic database, 
using a s eleaor associated with a USP without first performing the required research on the 
selector 


D -tS//S[//MF) 


The query results were deleted|_ 


research selectors before submitting queries. 
I.A.1.C. (U) Detasking Delays 


Jfh^ analyst was counseled to 


(b)(1) 

(b)(3)-P.L. 66-36 
(b){3)-50 use 3024(i) 


Iselectors had not been detasked 


ked t 


N Jihe United States. Associated 
0 collection occurredL 


^ NSA analyst disc overed that! I 
I upon learning that 


Iselectors were detask ed on 


] The analyst was reminded 


of the importance of maintaining records of all selectors for a target in one location to facilitate 
tasking actions. 


(S//Sl i VfVDL TO UQjk. rvc -‘r)[ 


(b) (1) 

(b) (3)-P.L. 86-36 
an analyst discovered that a selector 


associated with a valid foreign i ntelligence target remained on task after the targe t had arrived in 
the United State d | . The selector was detasked P I All 

non-conipliant data was purged, and no reports were issued. 


( S // S 1//REL TO USA. TVCY H I an NSA analyst found that a selector 

associated with a foreign intelligence target remained on task after the target had arrived in the 
United States. | I the selector had be en inaccurately 

b etasked | I and all 


_Th e selector was 

non-compliant data was purged i 




(b) (1) 

(b)(3)-P.L. 


86-36 


ty /31//REL TO U5.\. rVCY) [ 


]it was discovered that a selector for 


a\alid foreign intelligen ce target remained on task while the target had been in the United States 

The selector had been[ 


Joftware glitch kept the selector 


but a 


allowing it to be accessed. 

Because 


Non-compliant data was purged. The software glitch was corrected | 

the error was found after the U S. travel, subsequent detasking was not necessary. 


(y/SI/VREL TO USA. FVCY )^_ 

selector had remained on task after it had be en learned[ 
selector was detasked 


an NS A analyst discovered that a 
jthat the target was a USP. The 


No collection occurred, and no reports were issued. 


(b) (1) 

- TOP SCCRET//SI//NOFORI^f^ (3)-P.L. 
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(S//SI//REL TOUSA. FVEY) |~ I an analy st found thal l I selectors had 

remained on task after it had been le arned ] [ that t he target was a U SP. The 

selectors were detasked I I Non-compliant data was purire d | | 

R equest for published reports was approva l Branch 

members were reminded to research selectors before taskina. . (b) (l) 

(b)(3)-P.L. 86-36 

(S//S1/)TICL TO USA. FVEY) | 1 an NSA analyst found that an e-mail 

selector associated with a valid foreign intelligence target remained on task while the taruet 
visited the United States. | 

| the United States, the e-mail selector remained tasked because the 
analyst had been unaware that the target had traveled to the United States. This detask dela y 
occurred! | 

I I but not to the NSA analyst, j | the e-mail selector,wasidletasked. 

Collection occurrecf. but purging was not required. No reports were issued. (b) (3)-p.l. 86-36 

(b)(3)-50 use 3024(i) 

(S i VSI//nnL TO USA. rvc ^ l l att NSA anal yst discovered that 

selectors had remained o n task when the target was in the United States I I 

I Traffic for the selector was not reviewed regularly. The selectors were 

detasked. and the non-com pliant data was pu rued. Procedures were established to monitor traffic 
more frequently for targets] »)( 1 ) 

__-rf))(3)-P-L. 86-36 -(b) (1) 

I.A.2 (U)| I (b)(3)-18 use 798 (b)(3)-P.L. 86-36 


(b)(3)-50 use 3024(t) 




I.A.3 (U) Unauthorized Access 


(5/ i '^RCL TO UGA. TVCY) An NSA manager discovered that j analyst 

under authority ofthe Director. NSA (DIRNSA) had been granted access to raw SIOINT 
databases that were not listed in the documents authorizing the access. The period of 
unauthorized access spanned | | The documents 

authorizing access were amended] | 

' (b) (1) 

(b)(1) (b)(3)-P.L. 86-36 

(b)(3)-P.L. 86-36 (b)(3)-18 USC 798 

(b) (3)-50 USC 3024(i) 
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(3//REL TO USA. FVEV) | I it was discovered tha t | 

[analyst had moved to a different mission element] but had kept 

access to NSA databases. A second analyst had been working under the same circumstances 

I After investigation, it was determined that there 
was no need to purge data, and no reports were affected. 

(S//REL TO USA. FVEY) j | it was discovered that several NSA 

analysts were operating in a location for which their access was not authorized. New 
documentation authorizing the analysts’ work at the location was subsequently submitted and 
approved 

(5//REL TO USA. PVEVl l I it was discovered thaij 

account authentication for a ra w SIGINT database had not been properly validated. I his 
occurred after a system upgrade] Proper account authentication processes were 

restored | 1 

^ ‘ ^* 1-1 I-1 

(b) (3)-p.L. 86- 3fs//RCLTOUOA. rvcv) | I it was discovered that ] 

analyst had accessed NSA raw traffic d atabases from a location not authorized for such access 
I 1 Because ofthe time lag in reporting, the exact databases 

accessed and the types of queries run could not be determined. Thel lis no longer 
accessing NSA databases from that location. 

( 3//9l//Nr') l I NSA database auditors discovered that an NSA 

analyst's access to a raw traffic database had iwt been delet ed when he resigned from NSA in 
I I I The error was detected when the 

analyst began working as a contractor for another 1C agency] j ] 


(G ' l ' Q l' i ' llCL TO USA. FVEV) | ] an NSA software developer performed 

a query through an online tutorial th at improperly accessed raw SIGINT data. The error 
occurred because the tutorial, which ] 

I The development team reinovet j 
The query results were deleted. 

(U//FOUO) In one instance, database access was not terminated when access was no 
longer required. Although not considered a violation ofE.O. 12333 or related directives, the 
access was terminated. 

(b) (1) 

I.A.4 (U) Unauthorized Dissemination (b) ( 3 )- 50 ^usc^ 3 oL(i) 


(S.VSb/NF) | l anNSA analyst mistakenly shared information 

associated with a USP in an e-mail to a customer. The analyst believed that the e-m ail 
containing the in formation was a published report ] ]] 1 

__]the analyst reported the incident, and] ] the analyst confirmed the 

recall of the information. 


(b) (1) 

(b)(3)-P.L. 86-36 


(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 
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(b)(3)-P.L. 86-36 


an analyst discovered 


(f p /yrd i ynPL TO t .ir .' V rvrvt l 

dissemination of USP information that was attributed to an error 

were repaired. The report was deleted, and 


The system 


associated data was purged from the databases. 


^G//01/, ' NF t[ 


analysts onl loccasions mistakenly 


disseminated raw SIGINT to customers not authorized to receive raw SIGINT On | | 

occasions, the data included USP information. The SIGINT was recalled. The analysts were 

reminded about dissemination policies. U) 

^ (b){3)-P.L. 86-36 




identifications had been mistakenly disseminated 
customers. The| {message was recalled. 


1 . ^ .u . •• • . J^(3)-50 use 3024(i) 

an analyst discovered that unmmnnized USP 

^toIC 


(SVSl' i 'REL TO US.\. FVCY) [ 


analyst operating 

under DIRNSA authority inadvertently disseminated USP information in a Web-based 
repository Tlie data was quarantined in the repository. and all copies of the dissemination were 
purged. 

(b)(1) ,_, 

(b) (3)-p.L. 86 - ^//sj//[x[;l TO USA. rVTY) | _lanNSA analyst mistakenly 

disseminated raw SIGINT in an e-mail to other NSA analysts not authorized to receive raw 
SIGINT. The receiving analysts had been delegated the SIGINT mission but had not completed 
the required training. The e-mail was deleted. 


(S//SI//REL TO USA. FVEYt 


an NSA analyst mistakenly 


disseminated USP information in an e-mail to a customer, who. in turn, forwarded the e-mail to a 
distribution list. Recipients were asked to delete the e-mail, and deletion was confirmed. 

1.6. (U) Foreign Intelligence Surveillance Act (FISA) 

I.B.1. (U) NSA/CSS Title I FISA 

I.B.I.a. (U) Detasking Delays 

an NSA analyst discovered that an e-mail selector 


■(b) (1) 

(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 


(TS//SI//MR-I 

authorized under a Foreign Intelligence Surveillance Court (FISC) Order 


(b)(11 
(b) (3)- 



1 1 .All non-compliant data was pursed, and no rei 

3orts were issued, 
and purging. 

;-mail selector 

The analyst was counseled resardins proper procedures for incident reportine 

tTS//Sl//NF)l Ian NSA analyst discovered that an t 

associated with a FISC-authorized target] 

1 


respoiisible for reviewing FISA traffic had left the branch and had not been immediately 
replaced. The selector was detasked. 


and query results 
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Tb) (1) 

(b)(3)-P.L. 86-36 
(b) (3)-50 use 3024(i) 


were deleted 


No collection occurred. and no report s were issued. The branch has 


instituted new procedures for monitoring targets and documenting traffic reviews. 


(TS/ZSIZ/NT) 


^nNSA analyst discovered that a cell phone selector 


associated with a FISC-authorized target ] 

I This error occ urred because the analyst believed that the 


target 


The selector was detasked 


reports were issued. All non-compliant data has been marked for purging, 
instituted new procedures for detasking selectors when learning that targets 


he branch has 


No 


(b)(1) 

(b){3)-p.L. 


86-36 


(T3 ' fa i ;/Nr) 


selectors were detasked and all collection terminated 


All 


All non-compliant 


data was piirce d. and no reports were issued. Branch analysts were trained regarding targeting 

I (b)(1) 

-^ (b){3)-P.L. 86-36 

I.B.I.b. (U) Unauthorized Access (b){3)-i8 use 798 


(b) (3)-50 use 3024(i; 

J an NSA branch chief discovered that personnel 
assigned to one N SA office had unauth orized access to NSA/CSS Title I FISA data within the 
office shared drive l } This e rror occur red because office management was 


(U// FOUC n[ 


unaware that access requirements had changed l aiKl system records on training and 


clearances were incomplete or inaccurate. Records have been corrected; personnel have either 

completed required training or have been removed from access. (b){3)-p.L. 86-36 


(OiVOh'i'RCL TO USA. PVD‘ I ' )[ 


it was discovered that five analysts 


who were properly trained to access data collected under FISA authorities were granted access to 
the data while s upporting a mission that was not authorized f or this access. The unauthorized 
access occurredT land raw traffic database queries 


were executed in this period. All query results were deleted. Individuals responsible for 

granting access were given additional training to prevent recurrence of this error. ( 3 )-p l 86-36 


(S//SI//RCL TO USA. FVEY) | | it was discovered that NSA/CSS 

Title I FISA data was accessibl e to personnel not trained or cleared for access to the data. A 
software glitch occurred during I 


thereby allowing 

potential access to the data. Transfer of data has stopped until the software problem is corrected. 
and all personnel w ho have access to the data repository have received (he required training. All 
I I data was purged from the repository. 


(O/ZOI'/RCL TO USA. rVCY) [ 


FISA data in a chat room that was not authorized for FISA, 
and was no longer available once the chat room was closed . 
personnel regarding posting of FISA data in this venue. 


J analy^s accidentally posted 


Data is not stored in the chat room 
Guidance was issued to all 
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■(bK3)-P.L. 86-36 


(u/ ‘ rouo ) [~ I it was discovered that personnel had unauthorized 

access t o NSA/CSS Title I FISA data This occurred because f | 


_I security protections were too br oad, and persomiel ha d not been trained or cleared for 

access. All problems had been resolved f ] ' (b) (l) 

(b)(3)-P.L. 86-36 

<ri//r>l//RCL TO USA, rvcvi I I it was discovered that 

NSA analysts on three separate occasions had loaded data into databases not authorized to hold 
FISA data. The records were deleted, and the analysts were counseled 


on 


targets^ 


Ian NSA analyst discovered that system data collected 

Jhad been 


erroneously forwarded to a local shared drive not authori ^ to hold FISA data. A s a result, the 
data was available to personnel not authorized for access 




JrRe non-conipliant data has 


been purged. 

I.6.1.C. (U) Data-Handling Error 


(b)(1) 

(b){3)-P.L. 86-36 
(b)(3)-50 use 3024(i; 




an NSA analyst discovered that collection on a selector^ 


| tad not been purged. On 
27 February 2012. all non-conipliant data was purged, and no reports were issued. The branch 
established new procedures for monitoring selector status. (b) (i) 

(b) {3)-P.L. 86-36 


I.B.I.d. (U) Database Queries 


had mistakenly performed [ 


an NSA datab ase audito r discovered tha t an analyst 
Jqueries on[ 


] selectors 


associated with FISC -authorized targets in a raw tra ffic database not authorized under FISA . 
The analyst was researching the selectors to support| | 

I I No results were returned by the queries, and no 

reports were issued. 


(TS//QI//Nr )[" 


on a FISC-authorized 
for 


who had assumed coveraae 


an analyst performed a query in a raw traffic database 

iThe analyst working 


mislAkiJhly fSh ihi querv' in an NSA database. The results were deleted. 


I.B.2. (0//REL TO IJ6A. FVEY) 


(b)(1) 

(b){3)-P.L. 86-36 


I.B.2.a. (U) Unauthorized Targeting 


(TS//S1//NF) 


a queiv had been pertbrined I 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


an NSA analyst discovered during a routine audit that 


The 
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(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-50 use 3024(i) 


query, which was poorly constructed, was stopped and the results deleted. A second query was 
performed | | but no results were returned. No 

reports were issued from either query. The analyst was counseled regarding proper query 
procedures and the importance of verifying selectors. 


I.B.2.b. (U) Unauthorized Access 


(TS/ZSIZ/NT) [ 


The analyst was authorized to view[ 


]anN SA analyst mistakenly accessed . 

[ data but had not completed the minimization 


data 


training required by the FISC Order. Access to the data has been restricted to database 
administrators while database capabilities to restrict access are reviewed. 


I.B.3. (T0//0 l // l »ir) Business Records (BR) Order 

(TS//Sl//Nr) d 


(b)(1) 

(b)(3)-P.L. 86-36 


call detail records oldW than the approved 
records, comprising approximately [ 


NSA determined that a technical server contained BR 


ive years. Approximately 


_^records, were retained for more than five 

years. The records were found on an access-controlled server that is used exclusively by 


technical personnel and is not accessible to intelligence analysts. 


See Section 


(bKi)l 


.L. 86-36 
50 use 3024(i) 


II.D.. ('oiigressloiuil anil!() HourJ Noiificafions. p. 2>. 

I.B.4. (T6//6 I // N r ) Pen Register/Trap and Trace (PR/TT) Order 


(TS.'.'SI.^/NE 4 The PR/TT Order expired on 9 December 2011 and was not renewed. 
I.B.5. (U) FISA Amendments Act(FAA) 


I.B.S.a. (U) Section 702 (b)(3)-P.L 86-36 

(U/ tfOUO) As previously reported. NSA/CSS has implemented a new proces s to ensure 
that FAA §702 data that is required to be purged is purged from NSA/CSS databases. | 


| to identity’ non-compliant data that should be purged. 
I.B.S.a.i. (U) Unauthorized Targeting 


E 


(Giffl l ' RIIL TO 

selectors that had been detaskedP 


]an NSA analyst mistakenly ret asked 
The selectors were detasked n 


and no collectionoccurrec 


(TS//Sl//I > iF) 


] an NSA analyst researcliing a tasked selector thought 


to be associated with a foreign intellige nce target traveling to the United States determin ed that 
the selector was associated with a USP | I The 

selector was detasked immediately. 


(b)(1) 

(b)(3)-P.L. 86-36 
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(b)(3)- 


(TS//SI//RCL TO USA. FVCY) 


NSA analysts 


discovered that selectors associated with USPs had been inadvertently tasked. The errors 
occurred because the analysts did not perform sufficient research on the selectors before tasking 
it. The selectors were detasked. data was purged, and no reports were issued. 


-t T3//0l//NP )[ 


while researching an alternate selector believed to be 


associated with a valid forei gn intelligence target, an NSA analyst discovered an 1C agency 
report issiied i I that indicated that the target was a USP In researching the primary 

selector before tasking ] | the NSA analyst did not uncover the report because the 

selector was misspelled in the report. The selector was emergency detasked. and all 
non-compliant data was purged. One report was recalled and re-issued. 


P.L. 


tasked [ 


86-36 




an NSA analyst, reviewing collection on a selector 


found information indicating that the target might be a USP. 


Investigation with an 1C partner confirmed the target’s USP status. The selector was detasked. 
all non-compliant data was purged, and no reports were issued. 


' f T '& ‘i ' S I /i'ROL TO USA. FVCY) | I an Oversight & Compliance analy st 

discovered that a se lector had been erroneously approved for tasking under FAA ^702 | | 

I I The error occurred because the analyst did not do sufficient research on the 

jdetasked | 


selector. The selector was 


the United States. All non-compliant data was purged 
I.B.S.a.ii. (U) Tasking Errors 


when the taruet traveled to 


(b)(1) 

(b)(3)-P.L. 86-36 


(b)(3)-P.L. 86-36 


TO USA. 


it was discovered that a tasked selector 


did not include the appropriate authorizations. A detask order was processed for the selector 


This system error was identified. and a correction was implemented. No 
collection occurred. 


( T3//3 I //RE;L to U S A. rVCV ) Oi j j iccasions 


NSA 


analysts discovered that selectors for foreign intelligence targets had been tasked incorre ctly. 
The selectors were detasked. and non-compliant data was purged or marked for purging, 
reports were cancelled and re-issued. 


(TS/i'SI/i'REL TO USA. FVCY) [ 


an NSA analyst discovered that a 
tas king cancellation had been improperly proc essed, allowing a selec tor for an e-mail account 
that j |the United Statesr H to be erroneously tasked. 

The taskinu was approved I I The error was identifled[ 


and the account was detasked immedia tely The revi ewing analyst has been~ad\'Tsed oftlie” 
proper procedure for canceling tasking |~ H All non-compliant data was purged, and no 

reports were issued. .(b)(1) 

,_, (b)(3)-P.L. 86-36 

(TS/ZSIZ/Nf) [_in NSA analyst di scovered that collec tion from a 

tasked selector had been dual routed to an 1C partner in error | | The selector 
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was i mmediately detasked. Nopuraini’ bv N SA is required: the IC partner will handle collection 
from I I in accordance with its minimization procedures 

(b)(1) ,_, 

(b)(3)-P.L- 86-36 -fTS/j’SlVi'MFH I it was determined that a target had traveled to the 

The selector was annroved 


United States in. 
for taskingf~ 


I; however, an 1C partner analyst 


but did not follow standard procedures for alerting NSA. The selector was not 
deiaskeci oe'cause the target had already departed the U nited States. No collection occ urred. 
IC partner analyst has been retrained on procedures for | and 

detaskinu. 


The 


it was discovered that a selector authorized under 


FAA §704 had been erroneously tasked under FAA §702 because of a miscommunication 
between NSA and an 1C partner. The agencies have highlighted the applicable legal standards 
and the necessity to communicate clearly among and between the agencies. The selector was 
detasked. and data was purged. 


(IS;/SFyKhL T OUAA. PVEV) [ 


an NSA analyst discovered that a 
selector associated with a foreign intelligence target had remaine d tasked while the tar get was in 
the United States. Although an analyst had detasked the selector F I the 

selector was retasked as a result of a system error that has since been fixed. The selector was 
immediately detasked. All non-compliant FAA §702 data collected was purged, and no reports 

(S)(1).P.L. 86-36 


(Tg/zgiz/RCLTOugA. r\cv) 


an NSA analyst discovered that a 


tasked selector associated with a val id foreign intelligence targe t had remained tasked while the 
target was in the United States from | ~| The error occurred because the 

analyst did not perform additi onal research on the taruet and was unaware that the target, who 
had been in the United States I I The selector was 


detasked. and all non-compliant data was purged. 


(TO 'G1//RCLTOU3A. FVm 


an NSA analyst discovered that a 


tasked selector associated with a valid foreign inte lliuence target had remained tasked while the 
target was in the United States I I Be cause of personnel changes, collection for 

the selector had not been reviewed I 1 The selector was not detasked because the 


target had already departed the United States. All non-compliant data was purged. The NSA 

office involved performed a review of selectors P | to address the effects of the 

personnel changes. (b)(1) 

(b)(3)-P.L. 86-36 

jI ^/RCL to USA. fvey I ' 




an NSA analvst discovered that an 


account a ssociated with a valid foreign intelligence target ) 

States on | | Traffic for the account had not been reviewed 

The selector was detasked. and all non-compliant data was purged. 


[the United 


(b)(3)-P.L. 86-36 
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I.B.S.a.iii. (U) Database Queries 


an IC customer notified an NSA analyst that a selector 
submitted to NSA by the IC customer for target development was associated with a USP The 
analyst had performed queries of FAA §702 databases for the selector on 3 days l ^ 

All query results were deleted. Checks performed by the NSA analyst before the query showed 
only foreignl I NSA informed the IC customer that NSA must be clearly warned about 

potential USPs m subsequent requests. 


- tTg/j ' Gi//Nn l 

selectors for a USP authorized underl 
and the query and results were deleted. 


an NS A analyst queried FAA §702 databases on 

The analyst immediately identified the error. 


(b)(1) 

(b)(3)-P.L. 86-36 


■f ro/,'oi/i'Nr) [ 


selector for a USP authorized |_ 


an NSA analyst queried FAA §702 databases using a 
I FAA §705(b). The analyst immediately 


deleted the query and results. The analyst’s raw SIGINT database access was revoked for 
30 days, and future queries will be reviewed by senior analyst before submission. 


(T0/i'0 l //Nr i[ 


target authorized under ! 
accessed from the United States 


I 


an NSA analyst queried a selector associated with a 


The selector had been detasked when it was found to be 
The query and results were deleted. 


7s/si Kb L lUL'.S.A. F\T¥tOi ] [ occasions 


NSA analysts performed overly broad queries without including search terms 


to limit the queries. In one case, the query returned results, which were deleted. The analysts 
were counseled to include terms to limit query results. 


■T T3 '' .'j | ", ' t»jr )[ 


3 an NSA database auditor discovered that an analyst 


had executed | | queries on selectors tasked under FAA §704 authority against FAA §702 data. 

The query results were deleted, and no reports were issued. The auditor reminded the targeting 
analysts ofthe prohibition on querying FAA §704 targets inFAA §702 collection. 


(TG)‘/01//[ICL TO USA. FVCY )[ 


an NSA analyst queried selectors 


against databases containing FAA §702 data without first researching the selectors to assess 
foreignness. The query returned USP information. The query and results were deleted 
immediately. The analyst was counseled on proper procedure for conducting queries.‘7b)(1) 

_ (b)(3)-P.L. 86-36 

(TS/ZSl/ZREL TO USA. FVCY) ! j anNSA analyst discovered that a 

selector associated with a USP and a uthorized under consensual col lection was erroneously 
queried in FAA §702 dat abases froml I T he error occurred because 

the selector’s USP status l I The query, which did not 

return results, was deleted. In the fiiture. the taraetins office will ensure that such selectors are 


[ 


] 


(T0//0l//N P)[ 


an NSA supervisor discovered that an overly broad 
query had been perfor med using a selector tasked under FAA §704 authority in an FAA §702 
database. The analysti jin developing the query. The query 
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results were deleted, and no reports were issued. Analysts in the production office were 
reminded of the rule prohibiting querying FAA §704 targets in FAA §702 collection. 


gS/ZSl/ZREL TO UGA. FVCY f i I an NSA analyst discovered th at a 

selector had remained tasked while the tar uet was in the U nited States I I The 

Iquerv ofFAA §702 databases and. as 
The selector was 


tasking analyst had misspelled the selecloi | 
a result, had not seen any traffic for the selector! 

I I This error also caused an associated selector to remain 


tasked 


All non-compliant data was purged. 


e 


^g//gi//pci TniiCA C^’CV^ 


NSA analysts submitted 


verlv broad database queries because they used an invalid search format without 


counseled to us 


The queries were deleted and did n ot return results. The analyst 


(b)(3)-P.L. 86-36 


i 'T S//Sr/R E L T O USA. F V E V) [ 


an NSA database auditor discovered 
that an NSA analyst had queried an FAA §702 database for selectors belonging to a USP. The 
error o ccurred because the analyst misunderstood query procedure. The query results were 
deletedf" I The analyst has received additional guidance on query procedures. 


(TS » vS I VRE fc- TOUSA. FVEY) | I an 100 deter mined that an NSA 

analyst had submitted I l overly broad queries] |withoutj 

avoid obtaining results on USPs. None of the queries returned results. The analyst received 
additional training. 

I.B.S.a.iv. (U) Detasking Delays 


(T3;V3 I / ' RGL TOU5A. ~ r 
selector that sho uld have been detasked 
jdetasked 


was 



an NSA analyst discovered that a 
^remained on task. The selector 


and all non-compliant data was purged. 


(T3//3 I //RFLTQU9A. r\TV) [ 


an NSA analyst discovered that a 


selector had inadvertently remained on task when the target entered the United States on 


was purged. 


The selector was detasked 


^ and all non-compliant datan. 


’(b)(1) 

{b)(3)-P.L. 86-36 


(T3/i'31//Nr) [ 


I an NSA analyst discovered that a selector nominated by 
an IC customer was tasked while the taruet was in the United States. The 1C customer analyst 


was not reviewing collection, believing that the selector had been detasked 


The IC customer’s t asking system did not reflect the retasking. The selector was 
detasked | I All non-compliant data was purged, and no reports were issued. 




(TG/ZS I z/RCL TOU3A. r\TY 


an NSA analyst discovered that a 


selector associated with a foreign intelligence target remained tasked when the target entered the 
United States! I Traffic for the selector was not being reviewed. The selector 

was detasked and all non-compliant data was purged. 
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(T9//3I//KEL TO I'SA. FN'E^'l l I an NSA analyst determined that a 

selector assoc iated with a foreign intelligence target remained tasked wliiie the target was in the 
U nited States I I An NSA analyst had detasked two other selectors for the target 

on | t he United States on I [ but 

overlooked detasking ofthis selector. The selector was detasked on j 

non-compliant data was purged. (b)(3)-P.L. 86-36 

(TG/ ' S I " RCL TO US.A. Ian NSA analyst determined that an 

account associated with a tasked seiector l I 

United States on | I The NSA tasking analyst believed that the selector 

had been detasked f } and thus had not reviewed collection for several weeks. The 

selector for the account was detasked | | all non-compliant data was purged. 

and no reports were issued. 


(T6//SI/ i 'NF ] l I an NSA analys t discovered that collection for a 

selector, properly detasked bv NSA I b ecause of | 

remained on dual-route to an 1C customer. The team respon sible for detasking the dual route 
missed the request and did not detask untill No purr’ing is required for NSA; 

the 1C customer will handle collection! jin accordance with its 


minimization procedures. 


(b)(1) 

(b)(3)-P.L. 86-36 


(TS//SI//REL TO USA. r\T'i )J _ | an NSA linguist discov ered that a 

target had been in the United States on I | The lingiiist_did not follow 

detasking procedures, and the selector was not detaskedT I The linguik has 

received follow-up training on the need fo j I detaskinu upon recognition of a target 

| ilie United States. All non-compliant data was purged. 

(TS//S I //P.EL TO USA. FVEV l I an NSA analyst learned that a 

selector associat ed with a foreiun intelli.uence target remained task ed while the taruet was in the 

United St ates on[ _ selector had b een detasked | when 

the target ! The selector had been mistakenly 

reapproved fortaskinu on All non-compliant data was puraed. 

— (TOi'/OI/ZtilP n I an NSA analyst reviewed information revealing that a 

selector associated with a foreign intelligence target had been erroneously tasked. The tasking 
analyst had n ot performed sufficient research before submitting th e selector for taski ng. A 
I ~l report issued by an 1C partner indicated that the target ! ~| the United 

States. The selector was immediately detasked. and all non-compliant data was purged. The 
targeting office has revised its targeting procedures. 

(TS/ZSIr/NF) ! I an IC partner determined that NSA mistakenly 

continued to task a sel ector when an associa ted selector was detasked on ! ~| 

because of the target’s l !the United States. T he selector was not detasked 

because the user left the United States as of ] | Non-compliant data was 

purged. 


(b)(1) 

(b)(3)-P.L. 86-36 
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(b)(3)-P.L. 86-36 


(TS/zSI/zREL TO UOA. r\TY ) 


an NSA analyst discovered that a 


selector inadverte ntly remained on task when associated selectors for the target weredetasked on 
I b ecause the target had entered the United States The selector was immediately 

detasked. and non-compliant data was purged. (b)(1) 

(b)(3)-P.L. 86-36 


(5//S1//RCL TO USA. rVCV) NSA discovered 
selectorsf 


that detasked (b)(3)-50 USC 3024(i) 


Thi s was the result of an e rror that occurred during an update to the internal r eport 
system sollvvarer H The software was corrected | 


(TS ' -S I R E L l UUSA. l- ' vl:)) [ 


] an NSA analyst discovered that a 


[ 


tasked selector believed to be associated with a foreign intelligence targe t was probably a USP 
and in the United States. The selector was detasked on | | All non-compliant data 

has been marked for purging, and no reports were issued. (b)(1) 

(b)(3)-P.L. 86-36 

(TS//St//RCL TO USA. rv &¥4f 


I 


a tasked selector had been deactivated 


] an NSA analyst determined that an 


account had been inactive since 
and all non-compliant data was purged. 

-ff6#S I)/aCL TO UOA. r^dCVl f 


1 The selector was detasked on 


he oijuinal 


Twith a tasked selector[ 


an NSA analyst discovered that an 
”]the United States between 


J The NSA tasking analyst had not reviewed associated traffic since 


detasked on 
issued. 

. 

(b)(3)-P.L. 86-36 (T0//QI//RCL TO USA. fVlIVl i 


believing t hat the selector had been detasked at that time. The selector was 
All non-compliant content was purged, and no reports were 


selector remained tasked when the target was in the United States on 

an NSA analyst de-tasked the selector, but the selector 


an NSA analyst discovered that a 

I On 


retasked because of a error 


The I lerror has been fixed. All 


non-compliant FAA $702 data collected was purged, and no reports were issued. 
(TS//SI/yNF) l 


~| an 1C customer w as informed by SIGINT Directorate 
Oversight & Compliance that a tasked selecto ^ Ithe United States from 18 thrnp gh 


(b)(1) 

(b)(3)-P,L. 86-36 


United States on 

\\ 

was detasked on 

_ 


I but did not detask the selector^_ 

land all non-compliant data was purged. 


I lie se 


Ihe 

ector 


(TS < VSI//REL TO USj\. FVEY) [ 


] an NSA analyst investigating an 


I t hat a tar get was in the United States determined that the associated selector should have 
been detasked ! H Collection had not been reviewed since that time because the 


analysts res ponsib le for the sel ector believed that it had been detasked. The selector was 


detasked on 


and all non-compliant data was purged. 
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I T 5//5 I //REL TO USA. FV ml 


a tasked selectoij| 


an NS A analyst found that an 
nhe United States on 


information onf 


selector was detasked on 
reports were issued. 

(b)(1) 

(b)(3)-P.L. 86-36 


The NSA task ing analyst h ad not detasked the selector upon receipt of 

_[regarding the| |the United States. The 


All non-compliant content was purged, and no 


(T3//SI/^RCL TOUSA. F\' ¥VT l 

a tasked selectorl 


I 


1 NSA had detask 


taiiietL 


w 


hen the 


an N SA analyst found that an 
I the United Stales between 
Jselector for the 


but the tasking analyst overlooked thel 


| ihe United States on 
Jselector, The selector was not 


detasked because the target departed the United States. All non-compliant data was purged, and 
no reports were issued. 


[ 


(TS//SI//RCL TO USA. rv e¥)[~ 
Ta tasked select^ 
ilec 


an NSA analyst discovered that 


Trattic tor the selector had not be en reviewed regularly by the tasking analyst. The 
selector was detasked | | All non-compliant data was purged, and no reports 


were issued 


. 


(TS//SI//RL:L TO U 3 A. r ' VEV )[ 


selector had remained tasked when the target ent ered the United States on 
Collection for the selector ha d not been rev iewedi 
detasked on l I All data from| 


J an NSA analys t discovered that a 


(b)(1) 

(b)(3)-P.L. 86-36 


The selector was 
was purged. 


(TS/ZSIZ/RIT TOU‘ i .\. r\ nV) | I an NSA tasking team reported that a 

selector ha d inad\ eitenilv rema ined tasked afte r the ori.ainal target was identified as a U SP and 
the target's! |>vere detasked onl I 


jcoHeclion^howe d that lire selector 


a foreign intelligence target 


] No collection for the original target occurred. 


(TG/'G I / ' I\CL TO U3A. r^T^i ^ ) [ 


associated with a valid foreign intelligence target 


lit was disco\ered that an account 


(b)(1) 

(b)(3)-P.L. 86-36 


] Because of miscommunication. the information onT 

] The selector wa^ 


received by the tasking team until[_ 

I I All non-compliant data was purged, and no reports were issued. 


[the United St ates since 
was not 
Jetasked on 


(TS//S1//REL TO USA. r>T:V) [ 


an NSA analyst discovered that a 


tasked account associated wit h a foreign intelligence ta rget had remained on task while the target 
was in the United States froinr I The analyst had stopped following this 

target as of ] 

The selectors were detasked and all non-compliant data was purged. 


(b)(1) 

(b)(3)-P.L. 86-36 
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0;3//5I//RCL to U3A. FVCY) [ 


I 


associated with a valid foreign intelligence targetl 
The targeting analyst researched 


taruel 


Jthe United States [ 


an NSA analyst received 


_Jhe United States on 

[and fo und no evidence that the 


jwas not determined. the selector was 
non-compliant data was purged 


_ 1 Although the reason for the 

Jdetasked I | . and all 


"rrST^TTTNFTT_ 

target was identified as a USP. On^ 


an NSA analy st 


Idetasked a selector after the 
an NSA analyst initiated tasking for a 
selector on the basis of lead information from an 1C partner. When inf ormed by the 1C partner 
that the target was a USP. the NSA analyst did not request cancellation [ 

All non-compliant data was purged. 


(TG/ i 'GIZ/RCLTOUSA. PYPT n 


learning that the target ha d traveled to the United Statesl 
request was not processed ! 


, .(b)(1) 

1 NSA detasked a selector upon (b)(3)-P.L. 86-36 
I The detasking 
NSA has since revised 


its processes to ensure complete detasking. 


( TS '' S I " ' RCL TOf i SA. rST>') |__^_^_^^_^^n^SAanalyst detasked a selector 
because the target was in the United States| | and| 

the United States l 1 T he selector was not detasked From f | 

when another analyst discovered the error. No collection 


targeting system 
occurred. 


(T9//5I//M:LT0U9A. r\TV) [ 


remained tasked for a target who was in the United States oi{ 


] NSA determined that a selector h ad 


had been detasked. but the analyst had overlooked 
I he selector was detasked on 


(T9/, ' 9 I /) ' [ICL TQUSA. rVTV) [ 


not co mpletely detasked a selector after the target had entered the United St^esf 
The analyst had detasked the selector 


and all non-compliant data was purged(b)(i) 

(b)(3)-P.L. 86-36 

NSA determined that an analyst had 


The selector was detask^ 


Jand no collection occurred. 


The analysts have been reminded of the procedures to ensure proper detasking 

I.B.S.a.v. (U) Data-Handling Errors 


(TGTOI/ RCLTOUSA. h ^ F T 
FAA ^<702 data had been i mpimieil^stor ed m a directory not'certified for FAA dat 


(b)(1) 

(b)(3)-P.L. 86-36 
(:b)(3)-50 use 3024(i) 
an NSA analyst discovered that 


I The file was 

protected and accessible only to the analyst. Backup copies of the uncertified directory aged off 
within two months. The entire production office has been reminded of proper handling 
procedures for FAA traffic. 


(b)(1) 

(b)(3)-P.L. 86-36 
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I.B.S.a.vi. (U) Unauthorized Dissemination 


(TSi'/Ql//REL TQUGA. rVC¥) [ 


it was discovered that NSA analysts 


had inadvertently disseminated FAA information via e-mail to a distribution list that contained 
an individual not authorized to review that information. The e-mails were recalled. The analysts 
were counseled on proper handling of this data and the need to ensure that recipients are 
authorized to receive the data 


( T3//3I//RCL TO UOjK. r\TV) [ 


an analyst mistakenly 


disseminated data to an e-mail group distribution list that included recipients not authorized to 
receive FAA §702 data. The analyst s ent a separate e-mail to each recipient requesting deletion 
of the message and confirmed deletion [~ 


(T3//S1//REL TOU3A. rVCV) [ 


jjanNSA analyst discovered that 


intelligenc e containing FISA/FAA data had been disseminatea via e-mail to unauthorized 
individuals ! I The analysts confirmed that all copies of the e-mail containing 

the intelligence had been deleted. (b)(1) 

(b)(3)-P.L. 86-36 


I.B.S.a.vi. (U) Overcollection 

(3//31//RCL TO U3A. FVC^' 


received for a tasked selector T 


an NSA analyst discovered that traffic 


.All non-compliant data was purged. 


The misconfiguration was resolved 


I.B.S.b. (U) Section 704 
(U) Nothing to report. 

I.B.S.c. (U) Section 705(b) 

I.B.S.c.i. (U) Unauthorized Targeting 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(b)(1) 

(b)(3)-P.L. 86-36 


■fP fiA ' O I ' Nr{ 


_an NSA analyst discovered that a t elephony selector 

thouuhi to be associated with an F.A.A §705(b)-authorized target was actuallvl I 


the selector was detasked. No collection occurred, and no reports were issued. 

an NSA analyst determined that a 


(TS/i'SI/i'RCL TO U S A. FV E Y) 


selector associated with a USP had been erroneously tasked 
selector was believed to be I 


selector was detasked. and data^s piirged 
(TS// Sh‘ / NF) 


I becausethe 

jselector for the intended foreign intelligence target. The 


an NSA analyst questioned an 1C partner about 


(b)C 

(b)(: 


reports were issued. 


The account was detasked. and data was purged. W 


.)-P,L. 86-36 
.)-50 use 3024(i) 
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I.B.S.c.ii. (U) Detasking Error 


(TS/>Sl//rUIL TO USA. F^TY )[ 


selector thought to be associated with a valid tbreisn Intel 


an NSA analyst discovered that a 


1 


was corrected 1 

bhortlv after the error was (i 


was detasked | 
issued. 

I.B.S.c.iii. (U) Unauthorized Dissemination 


The taskimi 


The selector 


No collection occurred, and no reports were 


(b)(1) 

(b)(3)-P.L. 86-36 


(T9/)Sh/Ri:L TOl ‘ b.V rvcv ) 


^analysts mistakenly 


disseminated unserialized summaries containing FAA ^705(b) and USP data in e-mails to 
recipients not authorized to receive that data. The analysts sent corrected summaries along with 
recall messages for all recipients to delete the original summaries and selectors, where 
appropriate, from all databases. The mission 100s confirmed the recall and destruction of the 
non-compliant summaries. 


I.C. (U) Consensual Collection 

(U) Nothing to report. 

I.D. (U) Dissemination of U.S. Identities 


(b)(1) 

(b)(3)-P.L. 86-36 


(T9//0I// NP')-The NSA/CSS enterprise issued|_|SIG1NT product reports during the 

first quarter ofCY20l2, In thos e reports. SIGINT analysts included information that identified 
USPs or U.S. entities on | l occasions while pursuing foreign intelligence tasking. The 
majority of the U.S. entities' names were those of Internet service providers in e-mail selectors. 
In l I SIGINT product s, disseminations were fou nd to be improper, and the reports were 
canceled as NSA/CSS | — [ analysts learned of USPs. U.S. organizations, or 

U S. entities named without authorization. All data in the canceled reports was deleted as 
required, and the reports were not re-issued or were re-issued with proper minimization. 


I.E. (U) Counterintelligence Activities 


(U) Nothing to report. 

I.F. (U) Detection and Prevention of Violations 

(TSi'/Sh/REL TOUS. ' V. FVEY) To reduce the risk of unauthorized telephony collection 
and prevent violations. NSA/C SS has instituted a process that Ln\es analysts greater and faster 
insiuht into a target’s location. I 
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(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


ICollected data was 

purged from NSA/CSS’s principal raw traffic repositories when required 


(T3yV3l//RCL TOUGA. rVC¥) | _ 

I NSA analysis found r I e-m ail accouiiis l I 

[ this quarter Collected data was purged from 
NSA/'CSS's principal raw traffic repositories when required. 

(b)(1) 

II. (U) NSA/CSS Office of the Inspector Genera! (OIG) 10 Inspections, (b)(3)-P-L. 86-36 
Investigations, and Special Studies (b)(3).50 use 3024(i) 


(U//FOU0) During the first quarter ofCY2012. the OIG reviewed various NSA/CSS 
intelligence activities to determine whether they had been conducted in accordance with statutes. 
Executive Orders. Attorney General (AG) procedures, and Department ofDefense and internal 
directives. With few exceptions, the problems uncovered were routine and showed that 
operating elements understand the restrictions on NSA/CSS activities. 


.A. (U//P eUO) 


(b)(3)-P.L, 86-36 


tS RCL TO F\T*1‘) .As nan ofa Joint IG inspection off 


I I the 10 inspection team reviewed 10 program management. lOtraininu. lOknow ledge. and 
the application of 10 standards in mission activities. The 10 team found that | | has 
improved its 10 program by developing a site Operating Instruction, which outlines procedures 
for 10 Incident Reporting and cross-agency collaboration between site 10 program managers 
Managing core 10 training accountability and compliance awareness, establishing an 
experienced and trained 10 team, and maintaining appropriate controls for FAA and FISA data 
pose significant challenges to the site. 


II.B. (U//FOUOT Cryptologic Services Group F 


(S//RELTOUSA. FVeV ) NSA/CSS OIG performed a short-notice inspection of 
I I The inspection was limited in scope to a review of 10 program 

manageme nt, training, a ccess to raw traffic databases, and dissemination of SIGINT. The OIG 
team found I I compliant with p olicy f or protecting and disseminating SIGINT; 

however, the team recommended that the | p evelop an 10 Standard Operating Procedure and 
a process to track database access. 

II.C. (U) Unauthorized Intelligence Activity (b)(3)-P.L. 86-36 


(U) Nothing to report. 
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II.D. (U) Misuse of the U.S. SIGINT System 

(U) Nothing to report. 

II.E. (U) Congressional and 10 Board Notifications 


(TS//SI//f'fF) On27April 2012. NSA/CSS notified the Congressional intelligence 
committees about retention ofBR-FlSA records beyond the five-year period authorized by the 
FISC. The Department of Justice provided preliminary notice to the FISC on 29 February 2012. 
See the referenced item under “BR Order" on page 14 


II.F. (U) Other Notifications 


(b)(1) 

(b)(3)-P.L. 86-36 


(TS//ShVREL TOl’SA. FV^EY) NSA/CSS has notified the AG ot1~~l intelligence -related 
collection activities associated with USP hostage and detainee cases. 


III. (U) Substantive Changes to the NSA/CSS 10 Program 
III.A. (U) | I 

(U//FOUO) As reported in the second quarter CY 2011 report. NSA/CSS had been 
developing a new tool to automate the process of submitting mission complia nce i ncident reports 
across the worldwide NSA/CSS enterpr ise. Because of system pr oblems. the | | . originally (b)(3)-P.L. 86-36 
scheduled to be tlilly operational for the j | is being redesigned. The 

revised implementation date is unknown. 


IV. (U) Changes to NSA/CSS Published Directives or Policies Concerning 
Intelligence, Counterintelligence, or Intelligence-Related Activities and the 
Reason for the Changes 

(U) Nothing to report. 

V. (U) Procedures Governing the Activities ofDoD Intelligence Components that 
Affect USP (DoD Directive 5240.1-R, Procedure 15} Inquiries or Matters Related 
to lO Programs 

(U) Nothing to report. 
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